allow user with read only permissions to still change their own account details.

This commit is contained in:
Keith Woodlock
2013-01-24 15:19:10 +00:00
parent 47f8dc9bc7
commit 91d50831f2
2 changed files with 15 additions and 3 deletions
@@ -309,4 +309,8 @@ public class CommandWrapper {
public String commandName() {
return this.actionName + "_" + this.entityName;
}
public boolean isUpdateOfOwnUserDetails(final Long loggedInUserId) {
return this.isUserResource() && isUpdate() && loggedInUserId.equals(this.entityId);
}
}
@@ -35,8 +35,17 @@ public class PortfolioCommandSourceWritePlatformServiceImpl implements Portfolio
@Override
public CommandProcessingResult logCommandSource(final CommandWrapper wrapper) {
context.authenticatedUser().validateHasPermissionTo(wrapper.getTaskPermissionName());
boolean isApprovedByChecker = false;
// check if is update of own account details
if (wrapper.isUpdateOfOwnUserDetails(context.authenticatedUser().getId())) {
// then allow this operation to proceed.
// maker checker doesnt mean anything here.
isApprovedByChecker = true; // set to true in case permissions have been maker-checker enabled by accident.
} else {
// if not user changing their own details - check user has permission to perform specific task.
context.authenticatedUser().validateHasPermissionTo(wrapper.getTaskPermissionName());
}
final String json = wrapper.getJson();
CommandProcessingResult result = null;
@@ -46,7 +55,6 @@ public class PortfolioCommandSourceWritePlatformServiceImpl implements Portfolio
wrapper.getEntityId(), wrapper.getGroupId(), wrapper.getClientId(), wrapper.getLoanId(), wrapper.getApptableId(),
wrapper.getDatatableId());
final boolean isApprovedByChecker = false;
result = this.processAndLogCommandService.processAndLogCommand(wrapper, command, isApprovedByChecker);
} catch (RollbackTransactionAsCommandIsNotApprovedByCheckerException e) {